-: Password security. 2 2
In this lesson, we're going to discuss 3 3
some of the best practices that affect our password security 4 4
in our networks and devices, in general, 5 5
the strength of our passwords and the level of security 6 6
is going to be defined in our password policies. 7 7
A password policy is simply a policy document 8 8
that promotes strong passwords 9 9
by specifying a minimum password length, 10 10
requiring complex passwords, 11 11
requiring periodic password changes 12 12
and placing limits on the reuse of passwords. 13 13
Password policies are used to mitigate 14 14
against the risk of an attacker, 15 15
being able to compromise a user, 16 16
administrator or service account 17 17
on a given network device server or workstation. 18 18
Utilizing two factor authentication is always going to be 19 19
a lot more secure than using just a password, 20 20
which is considered a knowledge factor. 21 21
But many of our network devices may only support a username 22 22
and password for their authentication. 23 23
If this is the case, then you need to make sure 24 24
you're at least using a good, strong password. 25 25
Now, a strong password is defined as one 26 26
who's complexity and length are sufficient 27 27
to create a large amount of possible combinations 28 28
so that brute force attacks can not be completed 29 29
in a reasonable amount of time. 30 30
Now, there is some debate 31 31
amongst cybersecurity professionals as to whether or not 32 32
you should use a long password or a complex password. 33 33
Traditionally, you may have heard 34 34
cyber security professionals promoting the fact 35 35
that you need to use a complex password. 36 36
Something that includes uppercase letters, 37 37
lowercase letters, numbers, and special characters 38 38
or symbols in order to have a strong and complex password. 39 39
But there is a big vulnerability 40 40
with using a complex password 41 41
and that's most people have trouble remembering them. 42 42
So people being people will tend to write down 43 43
these long passwords and reuse the same password 44 44
across multiple devices or websites. 45 45
This reduces the security of these complex passwords 46 46
and leads to them being compromised. 47 47
So as of the latest guidance 48 48
from the NIST special publication, 800-63B, 49 49
be known as the digital identity guidelines, 50 50
it recommends the password complexity rules 51 51
should no longer be enforced. 52 52
Instead, this special publication from NIST 53 53
recommends that you should use a long password 54 54
of up to 64 ASCII characters, 55 55
even if you're only using uppercase and lowercase letters. 56 56
This long password has a sufficient key space 57 57
to make brute forcing the password much more difficult. 58 58
If you had some numbers 59 59
and special characters to it as well, 60 60
while still making it something you can remember, 61 61
you're adding additional complexity to it too. 62 62
And this makes it even stronger though. 63 63
But again, if you have just a really long string 64 64
that doesn't have anything in it, 65 65
that's being repetitive in nature. 66 66
The longer password can be just as secure 67 67
as an eight character complex password. 68 68
Now, another common set of password policy guidance 69 69
that was previously followed closely 70 70
was in terms of password aging. 71 71
Now essentially, the old guidance recommended 72 72
that you should change your password every 60 days, 73 73
but under the new guidance from NIST, 74 74
they claim that password aging policies 75 75
should no longer be enforced. 76 76
Again, this goes back to the same problem 77 77
we had with long and complex passwords. 78 78
If you have some long, complex password, 79 79
and you have to change it every 60 days, 80 80
you're not going to remember it. 81 81
So you're just going to write it down. 82 82
So again, they recommend allowing longer periods of time 83 83
in-between password changes, 84 84
or even not requiring you to change your password at all 85 85
if they're long enough and strong. 86 86
Speaking of changing your password, 87 87
there's another policy out there 88 88
that's often enforced in organizations. 89 89
This policy requires that users cannot reuse an old password 90 90
when they change their current password. 91 91
Sometimes this setting is created 92 92
so the password history can't be reused 93 93
within the last five password changes, 94 94
while others may make it so you can't use a password 95 95
that you've used within the last 25 times, 96 96
either way is a way to increase the password history length 97 97
and make it so you can't reuse old passwords again. 98 98
Another best practice in terms of password security 99 99
is that you need to ensure 100 100
that you're following that all default passwords 101 101
are being changed on network devices, servers, 102 102
workstations, and service accounts. 103 103
By default, when you install a new device like a router, 104 104
a switch, or a firewall, or an access point, 105 105
they're usually going to have a default username 106 106
and password that's set up by the manufacturer. 107 107
This allows you to log in the first time 108 108
and be able to make changes. 109 109
For example, if you buy your internet service 110 110
from Verizon Fios, they're going to come 111 111
to your home or office and give you a default gateway, 112 112
this router device, their gateway is going to use 113 113
the username of admin and the password of admin 114 114
as their default setting. 115 115
So if you just install this as your new border router 116 116
or gateway, and you didn't change 117 117
the default username and password from admin admin, 118 118
anyone can simply log into the device and gain full control 119 119
over the device and control all the things 120 120
that are entering or leaving your network 121 121
through that device. 122 122
This is obviously not a good thing for security 123 123
and makes for a really weak network. 124 124
Now, if you're using Cisco devices in your network, 125 125
they come with default usernames and passwords 126 126
enabled by default as well, depending on the model, 127 127
it's either going to be something like admin and admin 128 128
or Cisco and Cisco or something like that. 129 129
To figure it out, you can just Google it and say, 130 130
this is my model number, what's the default password? 131 131
And you'll find it really quickly. 132 132
Now your servers and workstations 133 133
also do something very similar, with Windows for example, 134 134
there's an administrator account 135 135
that's created by default and up until recently, 136 136
the default password for this account was set as blank, 137 137
meaning it didn't even have a password. 138 138
This is completely insecure. 139 139
So you want to make sure you're always checking 140 140
these default accounts. 141 141
Remember, it's important to set up your password policies 142 142
to require users to have a long, strong password, 143 143
but it's also important that you change 144 144
that default password for any devices, 145 145
as soon as you install them 146 146
and connect them to your network.